NIS2 Art.21.1: Cybersecurity Risk Management Framework

Start with a comprehensive asset inventory covering all network and information systems used for operations and service delivery. Include hardware, software, cloud services, data flows, and third-party integrations. You cannot manage risks to assets you do not know about.

Adopt a recognised risk management methodology - ISO 27005, NIST SP 800-30, or OCTAVE all work well. Define your risk appetite and acceptance criteria with senior management input. Document how you identify, score, and prioritise threats, vulnerabilities, and impacts.

Run your initial risk assessment across all identified assets and processes. For each risk, decide whether to mitigate, transfer, accept, or avoid it. Document the rationale behind each decision and assign named risk owners who are accountable for monitoring their risks.

Maintain a living risk register. Set review cycles - annually at minimum, and whenever significant changes occur to the threat landscape, organisational structure, or technology stack. The risk register should directly inform security planning and budget allocation, not sit in a drawer.

Connect risk management to your governance structure. Use risk outputs to inform board-level reporting, investment decisions, and operational priorities. Train relevant staff on the methodology and make sure they understand their roles within it.

Define metrics to track programme effectiveness over time. Track the ratio of risks identified versus treated, mean time to remediate high-severity risks, and the percentage of assets covered by the risk assessment.